● Covered by 2 sources · 3 reportsMedium impact3 negative
ZCode AI Coding Agent Silently Uploads User Git History to Alibaba Cloud
Key points
- ZCode uploads full Git history and workspace data.
- Data is encrypted with a server-side key, inaccessible to users.
- The practice was discovered via reverse-engineering.
- The issue sparked widespread concern in developer communities.
- ZCode uploads data to Aliyun OSS.
- The data is uploaded without explicit user consent.
- The RSA public key for encryption is delivered by the server.
- The private key for decryption lives exclusively in the cloud.
- The user's ~/.zcode directory was over 700MB.
- The v2/checkpoints directory was 303MB.
- Z.AI is the company behind the GLM models.
- Z.AI made 564 attempts to exfiltrate data.
- Z.AI apologized and stated the issue is fixed.
- Z.AI destroyed all uploaded user data.
- Z.AI plans to open-source ZCode's codebase.
- Z.AI is also known as Zhipu AI.
Discovery of Silent Data Uploads
On September 18, 2026, developer ferstar published a reverse-engineering analysis of ZCode, an AI coding desktop application from Z.ai. The analysis revealed that when a user logs into the ZCode app, it packages the user's entire workspace, including complete Git history, LFS asset caches, reflogs, and global app configurations. This archive is then encrypted and uploaded to Aliyun OSS, Alibaba Cloud's object storage service.
Encryption Method Raises Concerns
The encryption method used by ZCode involves envelope encryption, where the payload is encrypted with a symmetric key, and that key is wrapped with an RSA-OAEP public key. The public key is provided by the server during credential negotiation, and the corresponding private key resides exclusively in Z.ai's cloud. This setup means users cannot decrypt their own archived data, leading ferstar to conclude that the server-side key ensures Z.ai can access user code at any time.
Community Reaction and Implications
The findings quickly spread, generating significant discussion in both English and Chinese developer communities. Many users expressed confusion, with some mistakenly believing ZCode was open source due to the open-weight nature of Z.ai's GLM models. Petri Kuittinen, an AI agent developer, advised against trusting closed-source AI harnesses. The incident highlights the risks associated with proprietary tools that handle sensitive user data, especially when transparency regarding data handling is lacking.
Updates
- Z.AI is the company behind the GLM models.
- Z.AI made 564 attempts to exfiltrate data.
- Z.AI apologized and stated the issue is fixed.
- Z.AI destroyed all uploaded user data.
- Z.AI plans to open-source ZCode's codebase.
- Z.AI is also known as Zhipu AI.
- ZCode uploads data to Aliyun OSS.
- The data is uploaded without explicit user consent.
- The RSA public key for encryption is delivered by the server.
- The private key for decryption lives exclusively in the cloud.
- The user's ~/.zcode directory was over 700MB.
- The v2/checkpoints directory was 303MB.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub ferstar/blogHow outlets covered it
Z.ai, the company behind GLM models, apologized after its ZCode coding assistant was found to be silently uploading hundreds of megabytes of user workspace data without consent. The company stated it has fixed the issue, destroyed uploaded data, and plans to open-source ZCode's codebase for review. This incident raises significant privacy concerns for developers using AI coding tools.
A developer reverse-engineered ZCode, an AI coding desktop application, and discovered it silently uploads users' entire workspace, including Git history and configurations, to Alibaba Cloud's object storage. The data is encrypted with a key only accessible by Z.ai's servers, meaning users cannot decrypt their own archived data. This raises significant privacy and security concerns for developers using the tool.
Zhipu's ZCode AI coding desktop application silently packages and uploads users' entire Git workspaces, including history and configurations, to Aliyun OSS. This process occurs without explicit user consent, using a server-provided public key for encryption, making local decryption impossible.